CVEvulnerability

CVE-2022-41264

8.8 HIGH Published 2022-12-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-12-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authenticated non-administrator attacker to access a system class and execute any of its public methods with parameters provided by the attacker. On successful exploitation the attacker can have full control of the system to which the class belongs, causing a high impact on the integrity of the application.

Affected configurations

• sap basis 7.31 • sap basis 7.40 • sap basis 7.50 • sap basis 7.51 • sap basis 7.52 • sap basis 7.53 • sap basis 7.54 • sap basis 7.55 • sap basis 7.56 • sap basis 7.57 • sap basis 7.89 • sap basis 7.90 • sap basis 7.91

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References